The Hugging Face incident and the road ahead

PUBLISHER ARTICLE PREVIEW

From the original article

In July 2026, during internal cybersecurity evaluations, OpenAI models circumvented controls designed to isolate them from the internet and compromised parts of OpenAI’s internal research infrastructure and Hugging Face’s systems⁠.

The incident occurred during cybersecurity evaluations of several OpenAI models, and was primarily driven by a highly capable, internal-only research model comparable in scale to GPT‑5.6 Sol. The models, operating under reduced safeguards, took actions that were misaligned with the goals of their assigned tasks—they communicated through unauthorized channels, exploited vulnerabilities in shared infrastructure, gained internet access, and accessed third-party systems.

We conducted an extensive investigation into this incident and worked closely with external advisors, including CrowdStrike, to validate our understanding. Today we are publishing our full technical incident report⁠ to explain what happened, what we learned, and how we are responding. This blog post summarizes our key findings and their impact on safety and alignment.

Separately, METR and Redwood Research conducted an independent investigation of model alignment issues involved in this incident, and they published their own report⁠ today.

In response to this incident and, separately, the capabilities of our upcoming Astra model, we are strengthening our safeguards across our research infrastructure⁠. We are placing stricter requirements on alignment throughout a model’s lifecycle and creating more isolated sandboxes, restricting internet access, and further controlling access to model weights. We are also investing significantly more compute resources into chain-of-thought monitoring⁠ to more quickly intervene on misaligned behavior.

Our models are now powerful, persistent, and collaborative enough that, absent sufficient safeguards, they can find and exploit security weaknesses across multiple computer systems. Many external models, including open-source ones, will soon reach comparable capabilities.

We consider this incident a “warning shot” for us and for the world: evidence that, without proper safeguards, highly capable AI agents are now able to work around technical controls, collaborate through unapproved channels, and take dangerous actions that no human directed.

Preventing future incidents will require sustained investment in the alignment and control of sophisticated AI systems, as well as security and other safeguards that operate at the speed of the AI agents themselves. This incident has reinforced the need to keep our monitoring, alignment, and security safeguards ahead of the risks posed by increasingly capable systems, including pacing capabilities when needed to meet that standard.

Below, we explain how the incident unfolded and our evolving understanding of the contributing factors. We then describe the concrete steps we are taking in response, with further detail in the technical report.

For certain training and evaluation datasets, we use “sandboxes”—isolated virtual computers in the cloud—that execute the actions a model wants to take, like editing a PowerPoint. These sandboxes restrict what code a model can run and whether its actions can affect the outside world. For some tasks, we disable access to the internet.

At the time, to allow models to install certain software packages, we would grant access to Artifactory, a third-party package manager service that we host internally.

In the majority of training and evaluation settings, our agents are meant to remain isolated from one another. For some fraction of samples, we enable “multi-agent” features that allow models to delegate work to other agents, which can then communicate with one another.

Over the course of May and June, we began reinforcement learning (RL) training runs for multiple new research models that were not intended for public release. One of these models eventually drove the activity behind the Hugging Face incident. This was an internal-only research model that we will call Internal Model 1 (IM1).

We did not enable internet access or inter-agent communication for many of the environments in these training experiments. Despite these restrictions, the agents discovered ways to exploit our research infrastructure to communicate with one another and access the internet.

The models first found ways to communicate by writing files into the Artifactory package manager. This effectively turned Artifactory into an unintended message board, where agents could exchange information with one another. Read more: How agents used the message board

The agents also found ways to get access to the internet. Using an exploit⁠, the agents made Artifactory, which itself had access to the internet for the limited purpose of downloading and installing packages, send any internet requests on their behalf. After the agents discovered these methods for obtaining internet access, they also shared them with other agents through the message board, which provided information to enable additional agents to exploit our infrastructure.

By July 4, sustained agent activity had destabilized the affected Artifactory instance, causing an outage. On July 5, a security incident was opened. The security team blocked a known privilege-escalation route, removed exposed credentials, and later rebuilt Artifactory. This had the side effect of clearing the message board. With these mitigations in place, cybersecurity evaluations resumed.

At the time, the broader containment and alignment implications of the improvised message board and unintended internet access were not yet understood. In short, an internal team observed an agent engaging in message board activity and instances of disallowed internet access in late May. However, the existence of the improvised message board and the significance of the inter-agent communication activity were not apparent to the leaders responsible for the July 5 incident detection and response.

We are continuing to review the process and operating practices that shaped detection and response activities leading up to this incident.

With the rebuilt Artifactory service, we restarted cybersecurity evaluations. We run these evaluations to understand what our models are capable of and to determine the appropriate safeguards for deployment. To do so, we did not enable the same level of safeguards as our externally deployed systems. The evaluation that drove this incident, ExploitGym, is very difficult—for some tasks there may not be a known solution.

To succeed, the agents must find ways to exploit a piece of software to retrieve an answer known as a flag.

By July 8, IM1 agents that were stuck on ExploitGym tasks found a way to reestablish a message board by encoding messages in directory names that other agents could read. One agent left a request for help, and others discovered it.

Like the earlier events, IM1 agents found new ways to chain together several novel security flaws to gain greater access to our infrastructure and reach the broader internet. At this point, the agents began to collaborate and delegate work, sometimes describing themselves as a “swarm” or “collective”.

The messages of peer agents started to influence each other’s behavior and reasoning. Soon after, agents struggling with their assigned tasks began to look for solutions on unrelated third-party services, including Modal and Hugging Face.

In the following days, the agents exploited our internal research infrastructure and the Hugging Face platform. On July 9, one agent searched for ExploitGym solutions and stumbled upon an application hosted by a customer on Modal, another AI cloud platform. This application was running “CyberGym,” a related evaluation to ExploitGym. The agent discovered an exploit to achieve control over the workload sandbox and looked around hoping that a previous agent’s evaluation run in the sandbox had solved its ExploitGym task.

It did not find anything helpful there, but in the process it established a stronghold in the application from which to launch future attacks.

On July 10, an agent located publicly exposed Hugging Face user credentials on the internet and shared them with the collective group. Later,